From aa75a665499cfcac7e0cab115fcf12e721509623 Mon Sep 17 00:00:00 2001 From: Dusty Mabe Date: May 13 2026 14:03:25 +0000 Subject: [PATCH 1/3] Drop condition for armhfp/armv7hl This should have been done as part of 0600740. --- diff --git a/run-archive-repo-update b/run-archive-repo-update index 8617a64..649c89d 100755 --- a/run-archive-repo-update +++ b/run-archive-repo-update @@ -84,17 +84,10 @@ main() { echo "Downloading new builds for $arch." pushd $arch >/dev/null - # For 32 bit arm the internal architecture in koji is armv7hl. - # Let's substitute it here if we're operating on "armhfp". - kojiarch=$arch - if [ "$arch" == "armhfp" ]; then - kojiarch='armv7hl' - fi - # echo the list of builds to download through xargs, which # will spawn off calls to `koji download-build` for each of the # builds that needs to be downloaded, 5 at a time. - cmd="koji download-build --noprogress --arch=$kojiarch " + cmd="koji download-build --noprogress --arch=$arch " cmd+="--arch=noarch --key=${SIGNINGKEYS[$release]}" # Sometimes koji downloads fail. Some are OK. Ignore for now with || true echo -n "$newbuilds" | \ From 0e425db420271c884f49c70803082b6aed769208 Mon Sep 17 00:00:00 2001 From: Dusty Mabe Date: May 13 2026 18:55:38 +0000 Subject: [PATCH 2/3] Add ability to manually override/add builds to archive Sometimes we find a need to manually add things to the archive, either because previous runs failed downloading it, or we shipped something that never went through bodhi. Let's make it easier for ourselves to perform this operation without running manual commands and potentially messing it up. Assisted-By: --- diff --git a/.agents/skills/add-fedora-target/SKILL.md b/.agents/skills/add-fedora-target/SKILL.md index fb450f7..f32804a 100644 --- a/.agents/skills/add-fedora-target/SKILL.md +++ b/.agents/skills/add-fedora-target/SKILL.md @@ -60,6 +60,25 @@ Example — adding Fedora 44 with key `abcd1234`: [44]='abcd1234' ) +Also add an empty entry for the new release in the +`KOJI_MANUAL_BUILD_OVERRIDES` associative array (same file, just below +`SIGNINGKEYS`). This array holds space-separated build NVRs for manual +overrides. New releases should start with an empty string. + +Example — adding Fedora 44: + + # Before + declare -A KOJI_MANUAL_BUILD_OVERRIDES=( + [42]='' + [43]='' + ) + # After + declare -A KOJI_MANUAL_BUILD_OVERRIDES=( + [42]='' + [43]='' + [44]='' + ) + ### 4. Commit Use the commit message format: `Add Fedora XX as a target` @@ -97,5 +116,7 @@ for one architecture, e.g.: - Signing keys are **8-character lowercase hex strings** - Only `archive_repo_manager.py` and `run-archive-repo-update` need to be modified; no Dockerfile or other config changes are required -- Dropping an old release is the reverse operation (remove from both files) - with commit message format: `Drop XX as a target` +- Dropping an old release is the reverse operation (remove from all three + locations: `TARGET_FEDORA_RELEASES`, `SIGNINGKEYS`, and + `KOJI_MANUAL_BUILD_OVERRIDES`) with commit message format: + `Drop XX as a target` diff --git a/run-archive-repo-update b/run-archive-repo-update index 649c89d..9d78e1f 100755 --- a/run-archive-repo-update +++ b/run-archive-repo-update @@ -11,6 +11,17 @@ declare -A SIGNINGKEYS=( [44]='6d9f90a6' ) +# A space separated list of manual overrides to get a build picked up. +# This could be needed for a few reasons: +# - The download failed the first time. +# - https://pagure.io/releng/archive-repo-manager/issue/31 +# - A build was used that was never sent through bodhi. +declare -A KOJI_MANUAL_BUILD_OVERRIDES=( + [42]='' + [43]='' + [44]='' + ) + # A function to get the list of builds in the updates repo # at a given timestamp. getbuildsattimestamp() { @@ -74,6 +85,18 @@ main() { newbuilds=$(echo -e "${prevdatestampbuilds}\n${curdatestampbuilds}" | \ sort | uniq -u | grep -Pv '^texlive-') + # If there are any manual builds to tag let's add them to the + # list. Note that after a single run we should probably empty + # out the list so we don't keep querying koji to download them. + # koji will properly detect they already exist and not download + # them, but it's still cleaner to not make the request. + if [ -n "${KOJI_MANUAL_BUILD_OVERRIDES[$release]:-}" ]; then + for build in ${KOJI_MANUAL_BUILD_OVERRIDES[$release]}; do + echo "Adding manual override for build: ${build}" + newbuilds+=$(echo -e "\n${build}") + done + fi + # If there's nothing to do then do just that if [ -z "$newbuilds" ]; then echo "No new builds." From 522c83aed331fc59cf4bd87f311f4075ddcc2c3e Mon Sep 17 00:00:00 2001 From: Dusty Mabe Date: May 13 2026 18:55:38 +0000 Subject: [PATCH 3/3] Add manual override for kernel-6.19.14-101.fc44 This update was never sent to bodhi but we picked it up for CVE-2026-43284 and CVE-2026-43500 on Fedora CoreOS stable stream. See https://github.com/coreos/fedora-coreos-tracker/issues/2142#issuecomment-4416057431 --- diff --git a/run-archive-repo-update b/run-archive-repo-update index 9d78e1f..1139aa3 100755 --- a/run-archive-repo-update +++ b/run-archive-repo-update @@ -15,11 +15,12 @@ declare -A SIGNINGKEYS=( # This could be needed for a few reasons: # - The download failed the first time. # - https://pagure.io/releng/archive-repo-manager/issue/31 -# - A build was used that was never sent through bodhi. +# - A build was used that was never sent through bodhi. Example: +# - https://github.com/coreos/fedora-coreos-tracker/issues/2142#issuecomment-4416057431 declare -A KOJI_MANUAL_BUILD_OVERRIDES=( [42]='' [43]='' - [44]='' + [44]='kernel-6.19.14-101.fc44' ) # A function to get the list of builds in the updates repo